CVE-2023-3223highCWE-789

Undertow: outofmemoryerror due to @multipartconfig handling

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.5epss 2.7%

probabilidad de explotación

2.7%top 15% de las CVE

explotación observada

noninguna fuente lo reporta

A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of Service (DoS) attack. If the server uses fileSizeThreshold to limit the file size, it's possible to bypass the limit by setting the file name in the request to null.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Productos afectados

Red Hat · Red Hat build of Quarkus Red Hat · Red Hat Data Grid 8 Red Hat · Red Hat Decision Manager 7 Red Hat · Red Hat Fuse 7.12.1 Red Hat · Red Hat Integration Camel K Red Hat · Red Hat Integration Service Registry Red Hat · Red Hat JBoss Data Grid 7 Red Hat · Red Hat JBoss Enterprise Application Platform 7.1.0 Red Hat · Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 Red Hat · Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 Red Hat · Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 Red Hat · Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat · Red Hat JBoss Fuse 6 Red Hat · Red Hat OpenStack Platform 13 (Queens) Operational Tools Red Hat · Red Hat Process Automation 7 Red Hat · Red Hat Single Sign-On 7.6.5 Red Hat · Red Hat Single Sign-On 7.6 for RHEL 7 Red Hat · Red Hat Single Sign-On 7.6 for RHEL 8 Red Hat · Red Hat Single Sign-On 7.6 for RHEL 9 Red Hat · Red Hat support for Spring Boot Red Hat · RHEL-8 based Middleware Containers

Referencias